All Packages / edge-ech

How to install edge-ech on AlmaLinux, Rocky Linux, Oracle Linux and RHEL

Encrypted Client Hello key management for EDGE

Availability

Compare package tracks by distribution and architecture. Checkmarks show the architectures available in each repository channel.

Description

Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849). EDGE reads ECH keys while parsing its configuration, so a new key only takes effect on reload, and a client that picked up an older ECHConfigList from a cached HTTPS DNS record still needs the key it encrypted to. EDGE handles that by accepting several ssl_ech_file directives: the first is advertised in retry-configs, the rest stay loaded for decryption only. This package ships edge-ech-keygen, which maintains that rolling set under /etc/edge/ech and regenerates the include listing them, plus a systemd timer that rotates on a schedule. The timer is not enabled on install and nothing happens until you configure it. Set ECH_PUBLIC_NAME in /etc/sysconfig/edge-ech-rotate, run "edge-ech-keygen --init", publish the value it prints in the HTTPS record for your ECH-enabled names, then "systemctl enable --now edge-ech-rotate.timer". ECH only helps if the HTTPS record is served from a DNS-only zone and clients resolve over DoH. See https://nginx-extras.getpagespeed.com/ech/

Built for AlmaLinux, Rocky Linux, Oracle Linux and RHEL.

Install

sudo dnf -y install https://extras.getpagespeed.com/release-latest.rpm
sudo dnf -y install dnf-plugins-core
sudo dnf config-manager --enable getpagespeed-extras-edge
sudo dnf -y install edge-ech

Frequently asked questions

How do I install edge-ech on AlmaLinux, Rocky Linux, Oracle Linux and RHEL?

Add the GetPageSpeed repository, then install the edge-ech package with your system package manager.

Which Enterprise Linux versions is edge-ech available for?

edge-ech is available for RHEL 8, 9, 10.

Subscribe